0418692dfc8e114d76eab0ca18e47d68a424a699b24f92f1f69f2e227020df47

Analysis

max time kernel
151s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 65.3MB
Sample260820-h2rbwasarg
SHA256 0418692dfc8e114d76eab0ca18e47d68a424a699b24f92f1f69f2e227020df47
MD5 47043a0fd2b7f688a726dcd0878d7b33
SHA1 19ac52d6035f4df22623e9b777b27838802f73a9
SHA512 f2530b5fc4c060d499ac81f8ffd53f3031722a605e1e770a64e6ff6fac3160715bf47cdbe134b32cc3f74948956da118d256cc03d9c9f0832908c921b47094f6
SSDEEP 393216:y1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfe:yMguj8Q4VfvQqFTrYI
TLSH
T133E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1676	powershell.exe
6	1252	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3060	powershell.exe
3016	powershell.exe
1676	powershell.exe
1252	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes dropped EXE 6 IoCs

pid	Process
3464	chrome.exe
3684	chrome.exe
256	NVIDIAUpdate.exe
4040	IntelDriverUpdate.exe
4108	OneDriveSetup.exe
4112	SystemSettingsAdminFlows.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1424	cmd.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
16	api.ipify.org
1	api.ipify.org
1	checkip.amazonaws.com
7	api.ipify.org
14	checkip.amazonaws.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4488	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5108	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4484	cmd.exe
3576	cmd.exe
4584	cmd.exe
4928	cmd.exe
5428	cmd.exe
628	cmd.exe
2268	cmd.exe
3316	cmd.exe
5516	cmd.exe
1860	cmd.exe
2764	cmd.exe
6040	cmd.exe
5984	cmd.exe
4428	cmd.exe
2896	cmd.exe
1628	cmd.exe
2492	cmd.exe
4980	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
256	NVIDIAUpdate.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4968	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1056	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1676	powershell.exe
1676	powershell.exe
1676	powershell.exe
1252	powershell.exe
1252	powershell.exe
1252	powershell.exe
3060	powershell.exe
3060	powershell.exe
3060	powershell.exe
3016	powershell.exe
3016	powershell.exe
3016	powershell.exe
4724	WMIC.exe
4724	WMIC.exe
4724	WMIC.exe
4724	WMIC.exe
4904	WMIC.exe
4904	WMIC.exe
4904	WMIC.exe
4904	WMIC.exe
3228	WMIC.exe
3228	WMIC.exe
3228	WMIC.exe
3228	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	4488	tasklist.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeIncreaseQuotaPrivilege	3060	powershell.exe
Token: SeSecurityPrivilege	3060	powershell.exe
Token: SeTakeOwnershipPrivilege	3060	powershell.exe
Token: SeLoadDriverPrivilege	3060	powershell.exe
Token: SeSystemProfilePrivilege	3060	powershell.exe
Token: SeSystemtimePrivilege	3060	powershell.exe
Token: SeProfSingleProcessPrivilege	3060	powershell.exe
Token: SeIncBasePriorityPrivilege	3060	powershell.exe
Token: SeCreatePagefilePrivilege	3060	powershell.exe
Token: SeBackupPrivilege	3060	powershell.exe
Token: SeRestorePrivilege	3060	powershell.exe
Token: SeShutdownPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeSystemEnvironmentPrivilege	3060	powershell.exe
Token: SeRemoteShutdownPrivilege	3060	powershell.exe
Token: SeUndockPrivilege	3060	powershell.exe
Token: SeManageVolumePrivilege	3060	powershell.exe
Token: 33	3060	powershell.exe
Token: 34	3060	powershell.exe
Token: 35	3060	powershell.exe
Token: 36	3060	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeIncreaseQuotaPrivilege	4724	WMIC.exe
Token: SeSecurityPrivilege	4724	WMIC.exe
Token: SeTakeOwnershipPrivilege	4724	WMIC.exe
Token: SeLoadDriverPrivilege	4724	WMIC.exe
Token: SeSystemProfilePrivilege	4724	WMIC.exe
Token: SeSystemtimePrivilege	4724	WMIC.exe
Token: SeProfSingleProcessPrivilege	4724	WMIC.exe
Token: SeIncBasePriorityPrivilege	4724	WMIC.exe
Token: SeCreatePagefilePrivilege	4724	WMIC.exe
Token: SeBackupPrivilege	4724	WMIC.exe
Token: SeRestorePrivilege	4724	WMIC.exe
Token: SeShutdownPrivilege	4724	WMIC.exe
Token: SeDebugPrivilege	4724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4724	WMIC.exe
Token: SeRemoteShutdownPrivilege	4724	WMIC.exe
Token: SeUndockPrivilege	4724	WMIC.exe
Token: SeManageVolumePrivilege	4724	WMIC.exe
Token: 33	4724	WMIC.exe
Token: 34	4724	WMIC.exe
Token: 35	4724	WMIC.exe
Token: 36	4724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4724	WMIC.exe
Token: SeSecurityPrivilege	4724	WMIC.exe
Token: SeTakeOwnershipPrivilege	4724	WMIC.exe
Token: SeLoadDriverPrivilege	4724	WMIC.exe
Token: SeSystemProfilePrivilege	4724	WMIC.exe
Token: SeSystemtimePrivilege	4724	WMIC.exe
Token: SeProfSingleProcessPrivilege	4724	WMIC.exe
Token: SeIncBasePriorityPrivilege	4724	WMIC.exe
Token: SeCreatePagefilePrivilege	4724	WMIC.exe
Token: SeBackupPrivilege	4724	WMIC.exe
Token: SeRestorePrivilege	4724	WMIC.exe
Token: SeShutdownPrivilege	4724	WMIC.exe
Token: SeDebugPrivilege	4724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4724	WMIC.exe
Token: SeRemoteShutdownPrivilege	4724	WMIC.exe
Token: SeUndockPrivilege	4724	WMIC.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 4428	5852	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	88
PID 4428 wrote to memory of 2896	4428	cmd.exe	90
PID 5852 wrote to memory of 1424	5852	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	91
PID 1424 wrote to memory of 2096	1424	cmd.exe	93
PID 5852 wrote to memory of 5428	5852	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	94
PID 5428 wrote to memory of 4956	5428	cmd.exe	96
PID 5852 wrote to memory of 4484	5852	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	97
PID 4484 wrote to memory of 3152	4484	cmd.exe	99
PID 3464 wrote to memory of 3576	3464	chrome.exe	102
PID 3576 wrote to memory of 1676	3576	cmd.exe	104
PID 5852 wrote to memory of 3684	5852	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	105
PID 3684 wrote to memory of 1860	3684	chrome.exe	106
PID 1860 wrote to memory of 4488	1860	cmd.exe	108
PID 1860 wrote to memory of 3904	1860	cmd.exe	109
PID 3464 wrote to memory of 628	3464	chrome.exe	111
PID 628 wrote to memory of 1252	628	cmd.exe	113
PID 3464 wrote to memory of 2764	3464	chrome.exe	114
PID 2764 wrote to memory of 1936	2764	cmd.exe	116
PID 3464 wrote to memory of 2268	3464	chrome.exe	117
PID 2268 wrote to memory of 4740	2268	cmd.exe	119
PID 3464 wrote to memory of 1628	3464	chrome.exe	121
PID 1628 wrote to memory of 4968	1628	cmd.exe	123
PID 3464 wrote to memory of 256	3464	chrome.exe	124
PID 3464 wrote to memory of 1056	3464	chrome.exe	126
PID 3464 wrote to memory of 3316	3464	chrome.exe	128
PID 3464 wrote to memory of 5516	3464	chrome.exe	130
PID 5516 wrote to memory of 3060	5516	cmd.exe	132
PID 3464 wrote to memory of 4584	3464	chrome.exe	133
PID 4584 wrote to memory of 5832	4584	cmd.exe	135
PID 3464 wrote to memory of 2492	3464	chrome.exe	136
PID 2492 wrote to memory of 3016	2492	cmd.exe	138
PID 3464 wrote to memory of 4048	3464	chrome.exe	139
PID 4048 wrote to memory of 6016	4048	csc.exe	141
PID 3464 wrote to memory of 4040	3464	chrome.exe	142
PID 3464 wrote to memory of 4928	3464	chrome.exe	144
PID 4928 wrote to memory of 4724	4928	cmd.exe	146
PID 3464 wrote to memory of 5108	3464	chrome.exe	147
PID 5108 wrote to memory of 720	5108	cmd.exe	149
PID 3464 wrote to memory of 6040	3464	chrome.exe	150
PID 6040 wrote to memory of 4904	6040	cmd.exe	152
PID 3464 wrote to memory of 2288	3464	chrome.exe	153
PID 2288 wrote to memory of 2536	2288	csc.exe	155
PID 3464 wrote to memory of 4108	3464	chrome.exe	156
PID 3464 wrote to memory of 5984	3464	chrome.exe	158
PID 5984 wrote to memory of 3228	5984	cmd.exe	160
PID 3464 wrote to memory of 1016	3464	chrome.exe	161
PID 1016 wrote to memory of 2232	1016	csc.exe	163
PID 3464 wrote to memory of 4112	3464	chrome.exe	164
PID 3464 wrote to memory of 4980	3464	chrome.exe	166
PID 4980 wrote to memory of 2844	4980	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\cmd.exe
    cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "AsusChipsetHandler" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "AsusChipsetHandler" /f
    3⤵
    PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "AsusChipsetHandler" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "AsusChipsetHandler" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /query /tn "AsusChipsetHandler""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "AsusChipsetHandler"
    3⤵
    PID:3152
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3464" 2>nul | find "3464""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 3464"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4488
  - - C:\Windows\system32\find.exe
      find "3464"
      4⤵
      PID:3904

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://checkip.amazonaws.com/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://checkip.amazonaws.com/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl -s --max-time 6 https://api.ipify.org/"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\curl.exe
    curl -s --max-time 6 https://api.ipify.org/
    3⤵
    PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl -s --max-time 6 https://checkip.amazonaws.com/"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\curl.exe
    curl -s --max-time 6 https://checkip.amazonaws.com/
    3⤵
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\DellMonitor_ph0ccl\NVIDIAUpdate.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\DellMonitor_ph0ccl\NVIDIAUpdate.exe --SocksPort 9628 --DataDirectory C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\DellMonitor_ph0ccl\data --Log "notice stdout" --DisableNetwork 0 --UseBridges 0 --ClientOnly 1 --NumEntryGuards 8 --NumDirectoryGuards 3 --CircuitBuildTimeout 30 --LearnCircuitBuildTimeout 0 --MaxCircuitDirtiness 600
  2⤵
  - Executes dropped EXE
  - System Time Discovery
  PID:256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1056
- C:\Windows\system32\cmd.exe
  cmd /d /c vol C:
  2⤵
  - Executes a command shell one-liner
  PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\reg.exe
    reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber
    3⤵
    PID:5832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb631d464a.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43BC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEF3E59C6332B43CD9AD4FD122DFCCC6.TMP"
    3⤵
    PID:6016
- C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe C:\Users\Admin\AppData\Local\Temp\th631d464a.jpg
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "F:\.drvid""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\attrib.exe
    attrib +h "F:\.drvid"
    3⤵
    - Views/modifies file attributes
    PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb6dea8a1f.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8CD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD6136A8884314A66ABDB3F19AC79F6ED.TMP"
    3⤵
    PID:2536
- C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe
  C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Temp\th6dea8a1f.jpg
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\SystemSettingsAdminFlows.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tbdb7042de.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EB8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFFDB9EEEB6D04A6DB068983D17AC3C1C.TMP"
    3⤵
    PID:2232
- C:\Users\Admin\AppData\Local\Temp\SystemSettingsAdminFlows.exe
  C:\Users\Admin\AppData\Local\Temp\SystemSettingsAdminFlows.exe C:\Users\Admin\AppData\Local\Temp\thdb7042de.jpg
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0d41faff8a8d5300df04a99d3b9305e520e1f96cc2f667935cf69b74eb0691b0
MD5 fdafc6b42da93184e7311b68654989b8
SHA1 e4a849eac078f587d814d4074d1c7cecf9d229d1
SHA512 45b3884ffc14cc02459196eb425df3350ad83ea36586016c43d828def636517118aa163f25888a41a164261c3f1afa8371a8fe65eca2a0be06fd4f5392924dc6
TLSH
T1E4215733F3CC86A4D89A413650CEAC1136B787DB409FDEABAB84D559B42F689CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0402972cc1f6b331b6d88698b966319dfe0621cfb8dffb4ce6ecc6b9365f4e8d
MD5 053ed02a6717af4fd21a505e561693a0
SHA1 ff102f0fb3281e0d40c5b334c9f9ae8e3f468e72
SHA512 5ce724ed3f36ec25bdf510f03f3574390a4457a70227760e7299f386754ef1cf517949537087d3625492abbeac23e2009cd2ff9363b16a163c3d69977481235d
TLSH
T1EB215733F3DC8724D89A413650CEAC1036B687DB449EDE9BAB84D558B42F289CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

.mid_cf6db1e6

Path C:\Users\Admin\AppData\Local\Temp\.mid_cf6db1e6
Size 36B
SHA256 fe47d0d0a3999d17b6a1b0dbf0e8d88c986c9bac7ee101292491d9c73abf0b57
MD5 4d17bb771342e4010fda6793d1470dd8
SHA1 2a547bdaeb03f83bc2755d4dded99b9dfbf1f6a4
SHA512 8f21c918007a6b93af8525e40ebac423813118f3908b65030508c047fd98a8df683357b825b1cc30c6ca197d23a8841b5417837d1154b9e9e5e9e61710b16399
MD5 SHA1 SHA512

Submit Download

.psvc_cb580e98cf20

Path C:\Users\Admin\AppData\Local\Temp\.psvc_cb580e98cf20
Size 283B
SHA256 7fdb8447aae02c5dfd359ddafd3ac470a5def7a2b973c91221ca38e63044dde0
MD5 a07ea8fd516454a36276917e1e9d05b7
SHA1 0d0eb47c7fc7e9ceab791b0ab2d583de3fbbf794
SHA512 bfdbdc468d9b42e9cdb64e9e883f7a8fe6e35018b0c2b0b0b0e12ba1b516789f348a07905a94042f28ebc921c6cbea409e3493b950ebdbd5097b8ffc12b128b0
TLSH
T18FD02B2CD411DE3FFC922E08527A6F0B34C9000731C09E1796004E48CBDC6A4D02D4A3
MD5 SHA1 SHA512 TLSH

Submit Download

.winsvc_cb580e98cf203c5d

Path C:\Users\Admin\AppData\Local\Temp\.winsvc_cb580e98cf203c5d
Size 4B
SHA256 0d3fa6dd8f23a9a7db9b1e3bcb8e32fe97f51c4f519bcca616ba2e7837efebc9
MD5 51e6d6e679953c6311757004d8cbbba9
SHA1 ea9dc5ff81bb2208f87693b33672f46366a66bed
SHA512 b7fa7b9dd539c2a85565d0499f82158a0974a9f9c14505ce0b5e148a4dba3a211fa59fc53d70ccd21900ba81e1b27a6a83c87c82b0587f81fcd8f7123ec22c7e
MD5 SHA1 SHA512

Submit Download

IntelDriverUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe
Size 5KB
SHA256 23a1f4cc19367082ad41f57d2501e86ecd3ded982e038b182af2df93598dbf81
MD5 d41403dc81b29705daa58c68a346c281
SHA1 a0dba3a1f67d6037a1a73bae1ab181af9b9883ea
SHA512 09b5579dcb882381ed165a6ce3f13c11d6bccca365fd70c55d7630b3ca014758af31a3b547aa56e02798d90ade841e8edcfd346cceb352cd1317c989f1bee2b4
SSDEEP 96:yy5oZT9jiQH8J+zqWlAYkYUP+v/gfBzNt:ykoZTMJ83AYkYUP+vQD
TLSH
T135C1B90A63E9C276D4DA0F7039B3871123B8E2614A6BD35E3CC4212E9F26B5009673F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe
Size 5KB
SHA256 ef26886c39452c1001997cd5834b4b4b8b618b944c3a0b2d669e9f9bb8336852
MD5 41d4445b5a6bd47c8ebb49a1f9eeacbe
SHA1 ccf17e48cd486c6af3adf25b39019c673eac5a64
SHA512 ba54ec654b264f727a59dd6db6eefe2f4855783b12549463d9318988122835f1fd4cc71840e5b736072db1258a81ac4407e75fb9920873cfe35ace5ac566d654
SSDEEP 96:5W5opT9jA4CMMbc+zqWlAYkYUX+vKqrSLXzNt:5oopTu3lI83AYkYUX+vKqSB
TLSH
T1DCC1B91967DD867AE0E64F7479F3871123B8E6604A26D31E3CC4211AAE16F6409663F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2EB8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2EB8.tmp
Size 1KB
SHA256 5b254c7c4e8dfe1e3256af3ee69135bc7f0aa812b23e2d4f30027667d23e6bfd
MD5 43f9ca82811e4dccdea298dbcfec6e65
SHA1 ba2bf38980db49927fbe9e3d191a2e47451796cd
SHA512 4cb1c97053ab6f73160bee8f61b86f1a14e84bfd4a397431d4cac57d17b7e65f8352811c3dd27bdd4e68a6ae5f0df9b1ed3ae252b80864337b94e627c3d14a6b
TLSH
T13C41364083EC471FE1724B3179FB97169278BE659EAB479DB184122F1E12740DDC36B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES43BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES43BC.tmp
Size 1KB
SHA256 c413fc9740d0ddac7df0356b8dbd7113eb07d77f247ba4845e7031ea7bd3bbf3
MD5 c824dc8a39da21cf0cf139d70dc108f0
SHA1 3d706053cb5c28af98cd13d74eb6e39791aa3d05
SHA512 13cd986d5210ad76149a069a62c60ff1170aa3195707fc7e7731c8a628782e8521339279171caec56f1bacf54f9ee02b0408a260cc2c1cdf97a78572be4b68c9
TLSH
T17D415341D3D84B1AF173473029FB9725A678BE65AFAA839D7184122F2F12740CDD3271
MD5 SHA1 SHA512 TLSH

Submit Download

RESB8CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB8CD.tmp
Size 1KB
SHA256 abf820180fc68648e0677a7266a4a5cb9974e794414fabf1809aba57e6b2a132
MD5 71b89c27a68042d63f2e1b7b0d03cc43
SHA1 8284da4d831304514d865e5bf2b299f7948ee121
SHA512 3e63f349b3acd933260c14c2371cc0ef3e70ae4bb2e92a9a66f574640b30aa8ddd3ea053049f22e80c84a9fbfd582982b2ae731401daab0ccdad51f072a1cc4f
TLSH
T10741314193D84B1AF272473029FB9726E778BE56AEEA835DB488122E1F01740CDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

SystemSettingsAdminFlows.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemSettingsAdminFlows.exe
Size 5KB
SHA256 b2f6fa0f44e73950c1f2a67e39df2d9c37f54c6d7e04b344989cb4e9234ae421
MD5 df8deeab4827c2da10ad7748378f9fa6
SHA1 3a5ff30f1f4dec84f52c86a9b5e77f553e568a49
SHA512 beb18da6ab9d903341c483c1787f101725b401eed74e93bb79e1e942230518508d30fc2aeaa17fbf6660e40db9a37c18cae5196299df1e14def15014f98d4ae7
SSDEEP 48:6bIwCg2oPLlDTkwj082A1Xn2JOn+zqGlaOheNykYarcw9e1BZtOuluaqqXSfbNtm:95oRT9jJPV+zqWlAYkYUR+vTAayzNt
TLSH
T182C1B61567A9856AD4EA4F7079B3831217B8E7744A27836E3CC4211EAE22B6019633B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i0a5adwm.da3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0a5adwm.da3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

th631d464a.jpg

Path C:\Users\Admin\AppData\Local\Temp\th631d464a.jpg
Size 86KB
SHA256 5b42e80dac207fbb119ab0545db9851957a32be91440c7341212f6995418086b
MD5 9a012a2ceb573f33ee374f494637db9f
SHA1 f2fc33190c7da6f7d69fd71b1aa8e8ae8b3f4e68
SHA512 357308eba5e8d36919b3db9547373578f7cb96143635db6c4988ee4b06a3b1fc98e952e3d7aa4e1cf9c808c0d7526b169e95a3fe2d37479a0707bacbd2645ca2
SSDEEP 1536:Un5TannnnnnnnnnnnncRYfYzcyAa86AmjRMBDbcmwrCHbZVmk02Q2oe:qbkFEBjiBDbcmwmHbZ702Ke
TLSH
T1618314079C588783A46C47E9BD074E9D5F4B6B0CE9927AFF51220EDF7D602221D9E02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th6dea8a1f.jpg

Path C:\Users\Admin\AppData\Local\Temp\th6dea8a1f.jpg
Size 86KB
SHA256 35e2447e6e839bdab4ebee518f2853def739836ce6c6016fc73e8f55356ec1d4
MD5 c3179cfe680f700e959a46e711bd6d17
SHA1 cfe2058fac0946738a10843c7b5bb6fb129448c4
SHA512 31b27b24c79eb6d8a3d8b05c82ed852e34e76f2ab83646eb5e8a23ef8ed4ebd62273b18643aed57c6bd689f24beb783ccd3723cdbb95faf5b83f7561de8ba8d8
SSDEEP 1536:Un5TannnnnnnnnnnnncRYfYzcyAa86AmjRMBDbcmwrCHbZVmk02Q2ve:qbkFEBjiBDbcmwmHbZ702de
TLSH
T1E88314079C588783A46C47E9BD074E9D5F4B6B0CE9927AFF51220ECF7D602221D9E02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NVIDIAUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\DellMonitor_ph0ccl\NVIDIAUpdate.exe
Size 9.9MB
SHA256 5c204e004ec7f65ebe3a9bdc55170144a1067bf89a6712b87e0825a036e45ff8
MD5 e7a2dcb8517590998754000074ebe058
SHA1 a349c04514d14dea3ac435b05a6f33112d0a6ba8
SHA512 30b7dc2e768cac57c9b4620a0f03180c22aeda7857090d4bcfa3c113dbda87b89ca59c06310d8584a86fca8cb3cca3cd0c0b31e34c54c52ab07fc5f82c643b11
SSDEEP 98304:VDzqKjm8GE+CTH/SDnmdNB9YKdzCOmCl1dvv1wDKlE/z7j6kR++:xaKJSPwzXmo1dvaRR
TLSH
T1D9A62947F27710DDC5BAC17892177223F9A13C8C81346B6B5A8097622B74B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\DellMonitor_ph0ccl\data\cached-microdesc-consensus
Size 3.5MB
SHA256 c62c6f2a4ca638d10f724551398bc846aff65865da628440bc583054be243b8b
MD5 f7e4326ceffe13e038ac865c94f3ff62
SHA1 edb112cb5b30cd07a65d539376140db5c1234315
SHA512 0ef5ddcc980fa09517c2656de4249194c446768029db852ccc0b2ea9cb87c2a994f530bc6669388f85a60a606ce222944bd5ac1758431e28919b23d11cc210bf
SSDEEP 24576:KZmK/+ki0iYASgd6QW3fNJZEGW0BGhe/027IBgjmb1Vw:KLzLs69JZB/0xU
TLSH
T158F533EA97124EEAD32A09DBE510FF7BF33F1725C2486B94296F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\DellMonitor_ph0ccl\data\cached-microdescs.new
Size 19.8MB
SHA256 ac842b73aa9b569dde3341fa6b6fe08f6984d2b9692b83a662b7cbcfdf07b725
MD5 6ade7c1a00e548eff023d6ea5fe98282
SHA1 d52e2128f5c188c7a7a4cd3bdd3a237ba758e19b
SHA512 765c5d7aee6e8292113f53f4e4349a130023d530d42eec19a29571d3f55fb93c20f52114fe3b7ab330497121e7fac923d185770b5842835a7e598f26bc74bac4
SSDEEP 24576:VfAVKkIYBpVVcEVuVgLqVcxDVrJYVmVl/08nVLkV3VUATNb1V6xbV338sAVUlVsK:/wjbszNNiBrPVzxm1CxL
TLSH
T10627AEDA899B00C14E05E7CDEC1207C3DF144B3E4A6041A176ABB66B7F7329EC55EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.drvid

Path F:\.drvid
Size 13B
SHA256 20bbebc89e25b849cc56f89ad96408e37e4a2b1687f76b65d7dbe6a6b6f3539c
MD5 c76a3e4aa1c84b692b51a4245e6ad800
SHA1 6609acd6bdfa1015fd27ed137f1c4780d87b377e
SHA512 0316a1db6b40a7f6993411f058eb4b7f5f49d5f8ede222a31be2efc8f0f8f27703dbcae67856b2e6fd9c0d2c43ba49e2e4c5d98cce70d0803d3eb90027989f11
MD5 SHA1 SHA512

Submit Download

CSCD6136A8884314A66ABDB3F19AC79F6ED.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD6136A8884314A66ABDB3F19AC79F6ED.TMP
Size 1KB
SHA256 999744dca64c70b2fda4f94e92cba992a1c4b034adb9f4e768ba466fe9c03676
MD5 8f7349bd79a94c46a4de52a3a4622e00
SHA1 bbed617f956684cdc52fe3fe2e529c5ca6fb7dc0
SHA512 6797f4d122951b74e13c1b4b9a29116eaeeee84f85e299aa5e3ec4069ed14102ca0c45ebe045d4a04b7f02324f1a28bdb2e489be37df0f9fccd4ba67a304853f
TLSH
T1BB21EF45A3EC521EF2F387306AF6C363916D7E568CBA83EC3488171F1B2590084836B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEF3E59C6332B43CD9AD4FD122DFCCC6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCEF3E59C6332B43CD9AD4FD122DFCCC6.TMP
Size 1KB
SHA256 7d9a43fa66ace9d5ead09484f0c94c66eabebf74c98d849ddaa61a680ef69ecf
MD5 94b65e640238b08ffbba02d41effd53a
SHA1 26027a912d14a818935beaaa689e13f77384e46e
SHA512 d5bdb6b7c3ea583d4f17b313fe9565a46c0cf075e1c692fd1c4d82a8b2864b37bd9e50f5f488e0378ab80e15c0c3c0f428021f3a18b4e0d207496ce76525820c
TLSH
T1DC21CC85A3E8421AF2F3473079F5D363916CBE669DBA83DC3488135F1F25A408493AB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFFDB9EEEB6D04A6DB068983D17AC3C1C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCFFDB9EEEB6D04A6DB068983D17AC3C1C.TMP
Size 1KB
SHA256 23a65b47f480c3064e086f919e677bc3db0559c1389aaa878e8148ba9fed5a8a
MD5 d3190d46fb0e00da6dddf089afc97a49
SHA1 4f5cf482d11ecfb2f5e215034d9e66af63d0249d
SHA512 3cdff7c818f5b2516022992fcbd6b2d493539a75f2a6e74054c4d77cca9c3e82f9404bba8189d7f83ee18eea6d8a47a40c42f1d35fc294b869be3dad8b66db14
TLSH
T18521AA45A2E8421EF2B34B3079F9D36391A8BE269C6A83DC7488135F1F25A10C493AB1
MD5 SHA1 SHA512 TLSH

Submit Download

tb631d464a.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tb631d464a.cs
Size 923B
SHA256 c6ff54dd3a703552310c280c739151a474f4b2cc4475b738209f27beda31b79c
MD5 0470fa83dca5ed81d6ffcd590762fcfa
SHA1 71122fb90564516ea5c4a534052bb9bdeb3de002
SHA512 8a828f118938422fbac1bee174c218cd83a5de2025d62edf97b7349b6c9a6f1d8b3aa44a0588179e6b34d02951d847b8f7924f945c2fe93bac44680fed9fee9b
TLSH
T1DD11147435AFC3896D631B222CDCD5850F39327032B56CEA9C5E85108A59D900B3CE34
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1676-16-0x0000020864B70000-0x0000020864B92000-memory.dmp

Download

memory/3060-69-0x0000023A66510000-0x0000023A66534000-memory.dmp

Download

memory/3060-66-0x0000023A66300000-0x0000023A663B2000-memory.dmp

Download

memory/3060-65-0x0000023A66090000-0x0000023A660AE000-memory.dmp

Download

memory/3060-68-0x0000023A66510000-0x0000023A6653A000-memory.dmp

Download

memory/3060-67-0x0000023A66080000-0x0000023A6608A000-memory.dmp

Download

memory/4040-86-0x0000000000670000-0x0000000000678000-memory.dmp

Download

memory/4108-112-0x0000000000D60000-0x0000000000D68000-memory.dmp

Download

memory/4112-126-0x0000000000010000-0x0000000000018000-memory.dmp

Download